Silence the deprecation warning on install

execFile was called with shell: true and an array of arguments, which Node
deprecates in DEP0190 because it concatenates the arguments by space
without escaping anything, giving the impression they have been made safe.
The warning was printed to the console on every install.

The arguments here are already escaped for the shell by escapeArg, so join
them into the command instead of handing them to execFile to concatenate.
Nothing about what ends up being run changes.

Point the escaping test at the same form so it covers what the installer
actually does, and stops emitting the warning itself. Its several hundred
round trip cases still pass, which is what confirms the escaping is
unaffected.

Fixes #851

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/create/create.js

@@ -118,12 +118,15 @@ async function safeOutputFile(file, data, options={}) {
 }
 
 async function execFile(cmd, args) {
-	const escaped = args.map(escapeArg);
-	logger.verbose(`executing ${cmd} ${escaped.join(" ")}`);
+	// Arguments are escaped here and joined into the command rather than
+	// passed to execFile. With shell: true it would only concatenate them by
+	// space without escaping anything, which is what it is deprecated for
+	// (DEP0190) as it gives the impression the arguments are made safe.
+	const command = [cmd, ...args.map(escapeArg)].join(" ");
+	logger.verbose(`executing ${command}`);
 	return new Promise((resolve, reject) => {
 		let child = child_process.execFile(
-			cmd,
-			escaped,
+			command,
 			{
 				shell: true,
 

test/create/escape_arg.js

@@ -8,10 +8,12 @@ const { escapeArg } = require("../../packages/create/escape_arg");
 const execFile = util.promisify(child_process.execFile);
 
 async function exec(file, args) {
+	// Escape the arguments and join them into the command the same way
+	// create.js does, rather than passing them to execFile which would only
+	// concatenate them by space without escaping (DEP0190).
+	const command = [file, ...args.map(escapeArg)].join(" ");
 	const { stdout, stderr } = await execFile(
-		file,
-		args.map(escapeArg),
-
+		command,
 		{ shell: true, cwd: __dirname, env: { ...process.env, pct: "%"} }
 	);
 	return { stdout: JSON.parse(stdout), stderr };